feat: dual upload system — direct file storage + PeerTube API integration

Adds a parallel PeerTube upload system behind a feature flag (disabled by default
until upload quota is granted). When disabled, the existing direct file upload
path works unchanged.

Files:
- src/PeerTubeService.php — credential storage (encrypted), OAuth2 token
  retrieval, multipart upload to /api/v1/videos/upload
- migrations/021_peertube_settings.sql — peertube_settings singleton table
  + peertube_upload_enabled site_setting (default 0)
- admin/actions/settings.php — peertube section handler
- admin/parametres.php / templates/admin/parametres.php — PeerTube UI section
- partage/fichiers-fragment.php — shows file inputs when enabled, TODO notice otherwise
- ThesisCreateController / ThesisEditController — handlePeerTubeUpload()
- tfe.php — PeerTube iframe embed detection
- AdminLogger — logPeerTubeUpdate()

app/migrations/applied/021_peertube_settings.sql

@@ -0,0 +1,21 @@
+-- Migration 021: PeerTube integration
+-- Creates the peertube_settings singleton table and the peertube_upload_enabled feature flag.
+-- The upload flag defaults to 0 (disabled) so existing deployments are unaffected.
+
+CREATE TABLE IF NOT EXISTS peertube_settings (
+    id           INTEGER PRIMARY KEY CHECK (id = 1),  -- singleton row
+    instance_url TEXT    NOT NULL DEFAULT '',
+    username     TEXT    NOT NULL DEFAULT '',
+    password     TEXT    NOT NULL DEFAULT '',  -- AES-256-GCM encrypted via Crypto.php
+    channel_id   INTEGER NOT NULL DEFAULT 1,
+    privacy      INTEGER NOT NULL DEFAULT 1,   -- 1=Public 2=Unlisted 3=Private
+    updated_at   TEXT    NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+-- Insert the singleton placeholder row so UPDATE always finds it
+INSERT OR IGNORE INTO peertube_settings (id) VALUES (1);
+
+-- Feature flag: disabled by default (waiting for upload quota)
+INSERT INTO site_settings (key, value, updated_at)
+VALUES ('peertube_upload_enabled', '0', CURRENT_TIMESTAMP)
+ON CONFLICT(key) DO NOTHING;